CVE-2024-13725
📋 TL;DR
The Keap Official Opt-in Forms WordPress plugin has a Local File Inclusion vulnerability that allows unauthenticated attackers to include PHP files on the server. This can lead to arbitrary code execution, access control bypass, and data theft. All WordPress sites using this plugin version 2.0.1 or earlier are affected.
💻 Affected Systems
- Keap Official Opt-in Forms WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data exfiltration, and persistent backdoor installation.
Likely Case
Unauthenticated attackers executing arbitrary PHP code, potentially gaining administrative access to the WordPress site.
If Mitigated
Limited impact if proper file permissions, web application firewalls, and input validation are in place.
🎯 Exploit Status
Exploitation requires sending crafted requests to the vulnerable endpoint with the service parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.2 or later
Vendor Advisory: https://wordpress.org/plugins/infusionsoft-official-opt-in-forms/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find Keap Official Opt-in Forms. 4. Click Update Now. 5. Verify version is 2.0.2 or higher.
🔧 Temporary Workarounds
Disable plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate infusionsoft-official-opt-in-forms
Web Application Firewall rule
allBlock requests containing suspicious service parameter values
🧯 If You Can't Patch
- Implement strict file permissions to prevent PHP file uploads
- Deploy a web application firewall with LFI protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Keap Official Opt-in Forms for version numberCheck Version:
wp plugin get infusionsoft-official-opt-in-forms --field=versionVerify Fix Applied:
Confirm plugin version is 2.0.2 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- HTTP requests with service parameter containing path traversal sequences (../)
- Unusual file access patterns in web server logs
Network Indicators:
- Requests to /wp-content/plugins/infusionsoft-official-opt-in-forms/ with crafted service parameter
SIEM Query:
source="web_server_logs" AND uri="*infusionsoft-official-opt-in-forms*" AND query="*service=*"